CVE-2026-98526

The Linux kernel contains a vulnerability in how the llc_alloc_frame() function reserves link-layer headroom. The current implementation uses the device type, which is insufficient for stacked Ethernet devices like VLAN devices . Because vlan_dev_hard_header() inserts a VLAN header before the low...

EUVD-2026-103571

In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for allocated frames llcallocframe reserves link-layer headroom using the device type. This is insufficient for stacked Ethernet devices such as VLAN devices, where vlandevhardheader pushes a VLAN...

CVE-2026-98525 mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctplookupprealloctag When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag iterates over the per-netns &mns-keys list and matches netid, reqtag, peeraddr, and...

CVE-2026-98525

The Linux kernel contains a vulnerability in the MCTP protocol within the mctp_lookup_prealloc_tag() function. When a socket transmits a packet with MCTP_TAG_PREALLOC set, the kernel incorrectly iterates over the per-network namespace keys list (&mns->keys) instead of the specific socket's tag...

CVE-2026-98525 mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctplookupprealloctag When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag iterates over the per-netns &mns-keys list and matches netid, reqtag, peeraddr, and...

EUVD-2026-103570

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctplookupprealloctag When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag iterates over the per-netns &mns-keys list and matches netid, reqtag, peeraddr, and...

CVE-2026-98524 rds: ib: Clear the sg list when mapping an MR fails

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rdsibmapfrmr stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rdsrdmamap unpins the pages and frees the scatterlist, but...

CVE-2026-98524 rds: ib: Clear the sg list when mapping an MR fails

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rdsibmapfrmr stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rdsrdmamap unpins the pages and frees the scatterlist, but...

CVE-2026-98524

A use-after-free vulnerability exists in the Linux kernel 's RDMA shared memory (rds) infrastructure. The rds_ib_map_frmr() function incorrectly stores a caller's scatterlist in a memory region (MR) before DMA mapping/registration is confirmed. If these steps fail, rds_ib_free_frmr() may return t...

EUVD-2026-103569

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rdsibmapfrmr stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rdsrdmamap unpins the pages and frees the scatterlist, but...

CVE-2026-98523 drm/client: fix restore of partially initialized client

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

CVE-2026-98523 drm/client: fix restore of partially initialized client

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

CVE-2026-98523

The Linux kernel contains a vulnerability in the drm subsystem where a NULL pointer dereference can occur when closing a DRM file descriptor. The issue stems from drm_client_register() adding a client to the device list before the hotplug callback completes; if the callback fails, the client rema...

EUVD-2026-103763

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

CVE-2026-98522 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

CVE-2026-98522 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

CVE-2026-98522

The Linux kernel contains a vulnerability in the drm/imagination driver where the pvr_mmu_map_sgl() interface failed to correctly propagate map failures to the pvr_mmu_map() interface. This flaw caused pvr_mmu_map() to continue execution instead of returning an error to the caller, potentially le...

EUVD-2026-103762

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

CVE-2026-98520 drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix use-after-free and multi-container gap in kfddevmapping kfddevmapping caches the addressspace of the first /dev/kfd opener so that the GPU reset path can call unmapmappingrange to zap all userspace mappings of...

CVE-2026-98521 drm/i915: fix incorrect RCU teardown order

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915gembusyioctl uses dmaresvforeachfenceunlocked to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is that th...